1. SSSD for Linux Authentication with Active Directory
Frank Penrose, Casey Coughlen – Engineering IT
Erik Coleman, Devin Gengelbach – Technology Services

2. Linux Authentication with AD
Brief History
Recent developments and plans
Best practices
Sample configs
Open discussion on what is needed next

3. Brief History of Linux Auth w/AD

4. Brief History of Linux Auth w/AD

5. Homage to Our Linux Friends…
David Anderson
Andrew Hurt

6. Active Directory – Linux Support
What we’ve done so far
POSIX (RFC 2307) Attribute Schema
uidNumber generation for netids
gidGroups for users

7. Active Directory – Linux Support
What we’ve got left to do
 Pre-populate homeDirectory: /home/netid
 Pre-populate loginShell: /bin/bash

8. Best Practices
Populate your created user and group objects with uidNumber and gidNumber less than
Restrict your search bases for users and groups to only the campus OUs and OUs that are COMPLETELY within your control
Put the group name for your own created groups into extensionAttribute12
If you use Kerberos for authentication, you should join your Linux computers to the Active Directory domain (Ask me why Engineering does NOT)
Set a minimum allowed uidNumber and gidNumber above 500
Use allowed groups and restricted groups in conjunction with access.conf and TEST TEST TEST
Monitor SSSD configurations over a few days before making production to ensure that caching is not running amok in the background

9. Sample Configurations
Illinois Wiki Space – Book of Engineering Linux-> SSSD
Config review and Demo Time

10. Active Directory – Linux Support
Other Issues
NIS Groups
UID numbers under
Uniqueness of uidNumber / gidNumber
Bear in mind IAMU role in this—providing authN/authZ infrastructure. We aren't going to be forcing ways to do things. That said, we have to caution the use of OUs as security boundaries

11. Give us your Feedback! What are we missing? What do you want to see?
What about
NIS Groups
Global uidNumber  plan (< 100,000)